Malware detection

[sathishkumar.c]

Hi Team,

In our environment, a file was detected as malware. Based on the investigation, the file was downloaded using Firefox. We need to identify the exact source URL from which the file was downloaded.

We have already checked the Causality Chain for the file, but multiple URLs are displayed, making it difficult to determine the actual download source.

Could you please advise how to identify the exact download URL in Cortex XDR? Specifically:

• Is there an XQL query that can correlate the downloaded file with the corresponding network connection?
• Is there a recommended method to identify the exact URL when multiple URLs are present in the causality chain?

Thanks,

Sathishkumar C.

[ChrisDavila]

Try the 'action_process_file_web_mark' field. You may need the extended threat hunting module to use this field. 

Do you have sysmon logs? You can also check event code 15

[susekar]

Hello @sathishkumar.c ,

Greetings for the day.

1. Correlating Downloaded Files with Network Connections Using XQL

• Cortex XDR does not provide a predefined query to directly link a file-write event to its download URL.

• File creation events and network connection events are recorded separately in the xdr_data dataset.

• To correlate them, filter events using:

  • Same endpoint name.

  • Same browser process (e.g., firefox.exe).

  • File name or file path.

  • A narrow time window around the file creation timestamp.

• Review network activity immediately before the file-write event to identify potential download sources.

Example Correlation Query:

You can run an XQL query to review both the file-write activity and the network connections made by Firefox around the alert timestamp:

dataset = xdr_data
| filter endpoint_name = "<ENDPOINT_NAME>" 
    and actor_process_image_name ~= "firefox"
    and (
        (event_type = ENUM.FILE and (action_file_name ~= "<MALWARE_FILE_NAME>" or action_file_path ~= "<MALWARE_FILE_NAME>"))
        or event_type = ENUM.NETWORK
    )
| fields _time, event_type, action_file_name, action_file_path, dst_action_external_hostname, action_url, dst_action_ip, dst_action_port
| sort desc _time

2. Identifying the Exact Download URL

A. Mark of the Web (MOTW)

• Check the [www] or File Origin indicator in Causality View.

• Review HostUrl (download source) and ReferrerUrl (referring webpage).

B. Timestamp Correlation

• Identify the file creation timestamp.

• Trace preceding browser network activity.

• Exclude unrelated background connections.

C. Network Log Verification

• Check NGFW or proxy logs.

• Correlate endpoint IP and timestamp.

• Review HTTP GET requests to confirm the URL.

Note: Use MOTW HostUrl for direct identification. If unavailable, correlate timestamps with network and proxy logs.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar